DevOps Security Engineer

Job Overview

We are looking for a hands-on DevOps Security Engineer who will help secure our posture throughout the software delivery lifecycle — from the first line of code to production deployment and beyond. Our stack is complex. We ship frequently across multiple services running on containerized, cloud-native infrastructure managed entirely as code. Every release needs to be hardened before it reaches customers, and every pipeline needs to enforce that standard automatically. Your job is to make sure that happens — and to build the systems that make it repeatable, auditable, and fast.

Key Responsibilities

• Conduct deep-dive vulnerability and security reviews of all software releases before they reach production.
• Own the pre-shipment security gate process: define pass/fail criteria, enforce them in CI/CD, and be the escalation point when a release is blocked on a security finding.
• Triage and classify vulnerabilities from SAST, DAST, SCA, and container scanning tools.
• Maintain and continuously improve a vulnerability management program with clear SLAs for remediation by severity.
• Own and continuously improve the automated security tooling already integrated into our CI/CD pipelines.
• Build and maintain custom security automation — policy-as-code enforcement, secrets detection, dependency vulnerability scanning, image signing and verification — using Python, Go, or Bash.
• Audit the full infrastructure-as-code (IaC) stack — Terraform, CloudFormation, Helm charts, Kubernetes manifests — for misconfigurations, policy violations, and drift from security baselines.
• Define and enforce cloud security policies across AWS, Azure, or GCP environments using tools like Open Policy Agent (OPA), Checkov, tfsec, or equivalent.
• Harden container orchestration environments: RBAC policies, network policies, pod security standards, runtime threat detection, and supply chain integrity for container images.
• Be the engineering team's security partner, not their bottleneck.
• Build and maintain internal security guardrails: pre-commit hooks, IDE integrations, approved base images, hardened CI templates, and reusable secure-by-default modules.
• Run targeted threat modeling sessions for high-risk features and architectural changes.

Required Qualifications

• 3–5+ years in a combined DevOps / Security Engineering / DevSecOps role where you were building and operating, not just recommending.
• CI/CD pipeline engineering: Deep, hands-on experience with at least one of Jenkins, GitLab CI, or GitHub Actions — including writing custom plugins, shared libraries, or reusable workflow templates.
• Security tooling integration: Production experience implementing and tuning SAST (e.g., SonarQube, Semgrep, CodeQL), DAST (e.g., OWASP ZAP, Burp Suite), and SCA (e.g., Snyk, Dependabot, Grype) tools within automated pipelines.
• Cloud security: Proven ability to secure production workloads on at least one major cloud provider (AWS, Azure, or GCP).
• Container & orchestration security: Hands-on experience securing Docker and Kubernetes environments — image scanning, runtime security (Falco, Sysdig, or similar), admission controllers, network policies, and supply chain security (signing, SBOMs).
• Infrastructure as Code: Proficiency with Terraform, CloudFormation, or Pulumi, combined with experience auditing IaC for security misconfigurations using policy-as-code frameworks (OPA/Rego, Sentinel, Checkov).
• Scripting & automation: Strong coding ability in Python, Go, or Bash — sufficient to build custom tooling, write security automation, and contribute patches to application code when needed.
• Vulnerability management: Experience running or significantly contributing to a vulnerability management program — triage, SLA enforcement, risk-based prioritization, and metrics reporting.
• Solid fundamentals: Strong understanding of OWASP Top 10, CWE/CVE ecosystems, secrets management (Vault, AWS Secrets Manager), TLS/mTLS, and common attack vectors against web applications and APIs.